November 2026
Path MTU discovery depends on ICMP fragmentation-needed messages getting back to the sender. Block them anywhere in the path and large packets vanish silently while small ones work fine. The symptom looks like a partial outage.
Tunnels make this worse: every encapsulation layer costs header space, and the effective MTU is the minimum along the path, not the configured value at either end.
When something works for ping but hangs on curl,
clamp MSS and move on. Do not spend the afternoon on it.